Best Available Copy 



(FILE 'HOME' ENTERED AT 09:25:32 ON 10 DEC 1997) 



FILE 'INSPEC ENTERED AT 09:26:41 ON 10 DEC 1997 



LI 21 S (MACRO#) <5A) (VIRUS?) 

L2 554 S MACRO# (5A) (DEBUG? OR TEST? OR TEST? OR ANALY? OR CHEC 

L3 5 S L2 AND -VIRUS? 

L4 0 S L3 NOT LI 

L5 54 9 S L2 NOT LI 

L6 103 S L5 AND COMPUTER# 

L7 0 S L6 AND TEMPLATE 

L8 2 S L6 AND COMPAR? (5A) MACRO# 

L9 129218 S L2 AND DEBUG? OR SCAN? 

L10 91 S L2 AND (DEBUG? OR SCAN?) 

Lll 89 S L10 NOT LI 



FILE 'WPIDS' ENTERED AT 09:44:06 ON 10 DEC 1997 

L12 3 S LI 

L13 133 S L2 

L14 ' IS L13 AND VIRUS? 

FILE * COMPUSCIENCE ' ENTERED AT 09:45:36 ON 10 DEC 1997 

L15 0 S LI 

LI 6 OS MACRO# AND VIRUS? 

FILE 'DISSABS' ENTERED AT 09:46:15 ON 10 DEC 1997 

L17 0 S LI 

L18 5 S L16 

FILE 'JAPIO' ENTERED AT 09:47:13 ON 10 DEC 19 97 

L19 0 S LI 

L20 0 S L16 



FILE ' NLDB ' ENTERED AT 09:47:32 ON 10 DEC 1997 



L21 336 S L16 

L22 285 S LI 

L23 170 S L22 AND SCAN? 

L24 154 S L23 AND (SOFTWARE OR PROGRAM#) 

L25 145 S L24 AND (DETECT? OR REMOV? OR' CHECK? OR SCAN?) (5A) VIR 
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TI Word macro viruses eliminated 

SO ^Comp^i^r^Fr^ ^&^ ^cu^t y "Bui l.e.t i n , (1. Jun l~99'ff ) . 

ISSN: 0142-0496 . 
PB Elsevier Science 
DT Newsletter 
LA English 
WC 196 

TX CON— Technology* has announced the release of its anti-virus 
product Macro VirusTrack 6.0. This anti- 
virus software detects and 

removes, claim is makers, the five known Word macro 
viruses, and one significant trojan, before the malicious 
programs corrupt a Word document or spread to others . The 
product has been tested by the US' National Computer Security 
Association who have verified that the product protects against the 
Word Macro call of viruses. These 

viruses have quickly become the most common type of virus to 
affect computer users. They embed themselves in .DOC files and 
automatically do their damage whenever someone opens the document 
file. 

\Macro -VirusT rac k " 6T0 scans for the 
flve"~known Word macro viruses in two ways. 

Whenever the user attempts to open a Word document, the product 
checks for any of the known viruses. If a 
virus is detected, the ON program 

notifies the user that the document is infected and prompts them to 
clean the virus from it before restoring the document to its 
unaffected state. The program can also be configured to 
scan and clean documents on a user's workstation and network 
drives- without the user having to open each one individually. 

COPYRIGHT 1996 Elsevier Science Publishers Ltd. 

Subscription: $204 per year as of 1/92. Published monthly. Contact 
Elsevier Advanced Technology Publications, Crown House, Linton Road, 
Barking, Essex, IG11 8JU, U.K. Phone 01-594-7272. 
CT CE Computers and Electronics 

= > d all 88, 91 
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TI I^_INTRODUCES SAFER AND FASTER VIRUS PROTECTION FOR THE INTERNET 

PB Worldwide Videotex ~~~ 

DT Newsletter 



LA English 

WC 976 

TX feBTSH^SjE^^^ ^^^^ ipri 2 . 5~ features New "Check on Access" 
for Superior Virus Protection 

IBM has introduced a new version of its IBM Antivirus 
software that has been enhanced to provide safer, faster 
virus protection for the Internet, including the ability to 
scan Internet documents for viruses before they 
infect the computer. 

As more and more people access the Internet, online services and 
other global networks, viruses can spread faster than ever before. 
IBM Antivirus Version 2.5 provides protection from more than 8,000 
strains of computer viruses, including the Concept virus 
and other Word macro viruses . 



Macro viruses, which infect macro 

programs embedded in documents, have emerged as a new and 
rising problem. The Concept virus, for instance, which infects 
Microsoft Word documents, was first seen less than a year ago, and 
is now one of the most prevalent viruses in the world. 

IBM Antivirus Version 2.5 contains industry- leading new technology 
to prevent, detect, verify and disinfect Word 
macro viruses. And it has been designed to protect 
users from any future Word macro viruses, with 
free data file updates from IBM . 



Advanced Virus Protection 



Ideal for businesses of all sizes, as well as home users, IBM 
Antivirus Version 2.5 supports the most popular Intel-based computer 
platforms, including Windows NT. The software was recently 
certified to meet virus detection standards 

developed by the National Computer Security Association. Currently, 
the Department of Defense is installing IBM Antivirus at every Army, 
Navy and Air Force base nationwide. 

"IBM Antivirus is easy to use and provides the very latest 
protection for virus-free computing," said Randy Johnson, manager, 
Enterprise Support Services at Baxter Healthcare. "The product team 
is very flexible in terms of customizing the support offerings and 
they were extremely responsive in helping us get rid of a virus." 

The new version provides superior Internet protection, with its new 
"check on access" technology, which scans a file for 
viruses whenever it is accessed, including when files are 
uploaded or downloaded from the Internet, or via E-mail, online 
services, bulletin board systems or other sources. 

"Unlike other anti-virus products that are limited to specific Web 
browsers and sold separately, IBM Antivirus includes 'all-in-one' 
Internet protection," says Steve Rosenblatt, worldwide segment 
manager for IBM Antivirus. "Our new version has dramatic performance 
improvements. Independent testing confirms that IBM is a performance 
leader . " 



In addition to "check on access", IBM Antivirus scans 



memory, hard anc^^ioppy drives, and network, serverajfcpr thousands of 
viruses, includi^^Ppolymorphic viruses that change^^P 
avoid detection. It has dramatically improved its 
detection rate for boot viruses. For Windows 3.x 
users, IBM Antivirus now offers automated, scheduled 
scanning and uses a new VxD (virtual device driver) , for 
active protection, providing more complete protection than 
traditional TSRs can. 

Developed by Award-Winning Research Team 

Developed at IBM's High Integrity Computing Laboratory, IBM 
Antivirus incorporates world-class IBM anti-virus technology, such 
as neural networks that detect previously unknown 
viruses. At the laboratory, part of IBM's Thomas J. Watson 
Research Center, a team of anti-virus experts and professional 
developers have applied their expertise to the science and 
technology behind IBM Antivirus for over a decade. 

One of their key projects, an immune system for cyberspace, will be 
able to automatically detect and disinfect both known and unknown 
viruses in minutes via the Internet, working much like the human 
immune system. It was recently recognized by Discover Magazine as an 
outstanding technological innovation in computer software. 
In upcoming releases, IBM Antivirus will integrate more and more of 
this immune system technology, ultimately providing global, 
Internet-based protection from viruses. 

IBM Antivirus Editions 

IBM Antivirus Desktop Edition, designed for individual users, runs 
on Windows 95, Windows 3^x, OS/2 Warp and DOS. IBM Enterprise 
Edition for Networks is .ideal for businesses and networked 
environments . 

The enhancements to IBM Antivirus Enterprise Edition for Networks 
include : 

o CD-ROM packaging that decreases installation time. It includes a 
"bootable" emergency diskette that can disinfect systems so badly 
damaged by a virus that they cannot access the hard drive . 

o A new feature that provides easy customization, and the ability to 
distribute IBM Antivirus any way businesses currently distribute 
information: via LAN server, Lotus Notes, Intranet, FTP, E-mail or 
diskettes . 

o A new version management system that makes it simple to upgrade 
anti-virus protection in an enterprise environment. 

o A new 25-user license that is ideal for smaller businesses. 

o Support for a broad range of operating systems and environments, 
including Windows 95, Windows NT, Windows 3.x, Novell NetWare, OS/2 
Warp, IBM LAN Server, OS/2 Warp Server and DOS. 

Superior Customer Support 



IBM has a worldwide support team of ant i -virus experts and a 



Computer Emergent Response Team (CERT) to respond^^ickly to virus 



example, updates to detect any newly discovered Word 
macro viruses will be available on this site. For 

ongoing virus protection, IBM offers one- and two-year subscription 
plans, as well as free monthly virus detection 

and disinfection updates downloadable from CompuServe or the IBM 
Antivirus home page on the Worldwide Web. 

IBM Antivirus Version 2.5 will be widely available in mid August 
through reseller and retail outlets. IBM Antivirus Desktop Edition 
carries a suggested retail price of $4 9. Businesses have a wide 
range of options for purchasing the IBM Antivirus Enterprise Edition 
for networks. The suggested retail price for the initial 25 user 
licenses is $620. 

IBM Antivirus, is part of IBM's SecureWay family. IBM offers I/T 

Security consulting services, and hardware and software 

products with a strong focus on the Internet. These capabilities are 

de^cr.£bjsd-on:rrB^ 

http]77^ For more "Information on the IBM 

Antivirus solution7^i~sit~the product home page at 
p]rttp~r/ywww rbra call 1-800-742-2493 . 

COPYRIGHT 1996 Worldwide Videotex 

Subscription: $150 per year as of 1/92. Published monthly. Contact 
Worldwide Videotex, P.O. Box 138, Babson Park, Boston, MA 02157. 
Phone (508) 477-a979. 
CT CE Computers and Electronics 
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rVi ru s e s 08 / 16 /96 , J ~ ~~ ^ 

SO Newsbytes, (16 Aug 1996) . 
PB Newsbytes Inc. 
DT Newsletter 
LA English 
WC 334 

TX OTTAWA, ONTARIO, CANADA, 19 96 AUG 16 (NB) --By Grant Buckler. L ook f 
(Sof j^alre^Sys terns _.Inc_.*' has released a software 
add-on for Microsoft Word that scans for macro 
viruses. (yirus^Aler? for Macro will 

catch viruses that ordinary ant i -virus packages do not, a 
company official said. 

In recent months, viruses constructed using Word's 
macro language have been a growing concern. At least one 
macro virus written for Microsoft's Excel 
spreadsheet software has also been reported, but Word 
seems to be the main target . 

Stephen Goodchild, vice-president of sales and marketing at Look 
Software, said standard anti- virus packages, which run as 
stand-alone utilities, may catch macro viruses 

if they are on the system at the time it is started up and the virus 




>vides accurate 




"footprint" of the virus (a pat 
virus, which ant i- virus prograd| 




•n of 



ten 



use to spot known viruses) . 

However, Goodchild said, standard ant i- virus 

software will not usually spot macro 

viruses they don't know about tobegin with, while 

Virus Alert for Macro will identify macros 

that perform suspicious actions. Also, he said, Virus 

Alert for Macro scans each document that Word 

opens, so an infected document downloaded from the Internet and 
immediately opened cannot get past it . 

What Virus Alert for Macro will not do is spot 

viruses that are not Microsoft Word macros. You 

will still need a standard virus protection program for 

that, said Goodchild. Look Software will be glad to sell 

you one; the company's flagship product is Virus Alert Plus. 

Virus Alert for Macro is due to begin shipping 

on September 2, and the list price is US$29.95. Look will sell the 

software by phone order at 800-678-5511. Goodchild said the 

company has some retail outlets and is negotiating with distributors 

he could not name. Evaluation copies of the software are 

available at Look's site on the World Wide Web, ht tp"T/"/www7 look . com 

^ : -"v ■ * j 

(19960816/Press Contact: Stephen Goodchild, 613-822-2250, fax 
613-822-2160, Qlngernet^e^ail ^sgoodchi@iook ._ach^]^s^_net ,y Pub lie 
Contact: Look Software, 8 0 0-678-5511) 

COPYRIGHT 1996 Newsbytes Inc. 

Subscription: $300 per year as of 1/92. Published semi-weekly. 
Contact - Newsbytes, 4.06 West Olive Street, Stillwater, MN-55082-4945 . 
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TI Possible macro virus attacks and how to prevent 
them. 

AU Bontchev, V. (FRISK Software Int., Reykjavik, Iceland) 

Published by: Elsevier 

Price: CCCC 0167-4048/96/$15 . 00 

CODEN : CPSEDU ISSN : 0167-4048 

SICI: 0167-4 04 8 (1996) 15 : 7L . 5 95 : PMVA; 1- P 
DT Journal 
TC Practical 
CY United Kingdom 
LA English 

AB Computer viruses written in the macro language 

of powerful office packages, particularly of Microsoft Word for 
Windows are a relatively new phenomenon. Most of the viruses of this 
kind known to date rely heavily on the availability of the so-called 
•auto' macros (macros which execute automatically when the document 
containing them is opened or closed) in order to spread. This has 
created, among some anti -virus producers, the illusion 
that macro viruses have to depend on the auto 

macros in order to replicate. Based on this erroneous assumption, 
some companies have developed inadequate antivirus products and 
protection schemes. This paper demonstrates that the assumption is 
false-that there are many other ways which a WordMacro virus can use 
to get control and replicate successfully. The paper describes all 
these methods known to the author, emphasizes that they pose a 
problem mostly to the anti- virus programs of the generic kind (i.e., 
not to the virus- specif ic scanners) , and explains what measures have 
to be taken in order to block these attacks reliably. 

CC C6130S Data security; C0230 Economic, social and political aspects 
of computing; C7104 Office automation 

CT COMPUTER VIRUSES; DOCUMENT HANDLING; LEGISLATION; MACROS; OFFICE 
AUTOMATION; SOFTWARE PACKAGES 

ST macro virus attacks; computer viruses; macro language; 

office packages; Microsoft Word for Windows; auto macros; antivirus 
software; companies; virus protection schemes; WordMacro virus 



* 



LI ANSWER 14 OF 21 INSPEC COPYRIGHT 19 97 IEE 

AN 96:5370844 INSPEC DN B9610- 6210G- 008 / C961 0 - 0310D- 006 

TI What's in a word [computer viruses] . 
(SCT^SiSH^? "Comput ing- -(-Aug— -1-9-9-6 ) -p-.-3 2 - 3 . 0 ref s . j 

Pub 1 i s he d byT^W es t~Coa s t~ Publ±s h ilig~~~~~~~~ 

CODEN: SECOFD ISSN: 1352-4097 
DT Journal 
TC Practical 
CY United Kingdom 
LA English 

AB New information gathered by a UK government body, and revealed for 
the first time here, indicates that a dramatic "change is occurring 
in the computer virus world. The older types of viruses are being 
supplanted by the new macro viruses . 
Macro viruses are document borne viruses 

. The high incidence of documents (potentially infected) and 
diskettes (potentially infected) means that we may see a rising 
number of incidents in future. The trend is likely to be stoked up 
by email which is fast becoming the delivery method of choice for 
people-particularly those in medium to large organisations-wishing 
to exchange documents. In fact, the impetus for teleworking, global 
networking and workgrouping will see email' systems carrying more and 
more documents. 

CC B6210G Electronic mail; C0310D Computer installation management; 

C0230 Economic, social and political aspects of computing; C6130S 
Data security; C6130D Document processing techniques; C7104 Office 
automation 

CT COMPUTER VIRUSES; DOCUMENT HANDLING; ELECTRONIC MAIL; MACROS ■ 
ST computer viruses; UK government body; computer virus world; 

macro viruses; document borne viruses; email; teleworking; 

global networking; workgrouping 
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TI Mac ^5 malarkey [antivirus comparative review] . 
pSlKi^hM^ 

Price: CCCC 0956 - 9979/96/$0 . 00 + 2 . 50 
CODEN: VBULE3 ISSN: 0956-9979 
DT Journal 

TC Practical; Product Review 
CY United Kingdom 
LA English 

AB One of the most publicised virus 'events' of last year was the 
appearance of macro viruses, which have now 

spread world-wide. Close behind it ran the vendors, with various 
fixes and cures. Who has what, and how do they perform? Looks at 
ChekWare ChekWord, Cheyenne InocuLAN, and Command Software F-Prot 
Professional.. 
CC D1060 Security 

CT BUYER'S GUIDES; COMPUTER VIRUSES; MACROS 

ST antivirus; comparative review; macro viruses; ChekWare 

ChekWord; Cheyenne InocuLAN; Command Software F-Prot Professional 
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TI Comparative review: scanning NetWare [virus protection] . 
SO Virus Bulletin (April 1996) p. 14-20. 0 refs. 

Published by: Virus Bulletin 

Price: CCCC 0956 - 9979/96/$0 . 00 + 2 . 50 

CODEN: VBULE3 ISSN: 0 956-9979 
DT Journal 

TC Practical; Product Review 
CY United Kingdom 
LA English 

AB It has been a year now since Virus Bulletin last did a comparative 
review involving products designed to protect a NetWare network. In 
that year, many changes have taken place, not least the advent of 
macro viruses (included for the first time in the 

"In the Wild" test-set) . In addition to that, the overall number of 
viruses has been rising consistently, increasing the challenge to 
anti-virus manufacturers. The test-sets have been updated since the 
DOS comparative review in January of this year. As usual, of special 
note is the "In the Wild" test-set: this contains the viruses, 
listed in the WildList, which are a threat in the real world. One 
test-set is missing: NLMs are not tested against boot sector 
viruses. The Polymorphic test-set continues to grow in size and 
complexity: it now contains 7500 samples of fifteen viruses. 
CC D1060 Security; D2080 Information services and database systems 
CT COMPUTER VIRUSES; INFORMATION NETWORKS; SOFTWARE REVIEWS 
ST NetWare virus protection; Cheyenne InocuLAN v4 . 0 ; RG Software Vi-Spy 
NIM vl2.0; Central Point Antivirus v2 . 5 ; macro viruses; In 
the Wild test- set; ant i -virus manufacturers; DOS comparative review; 
WildList; boot sector viruses; NLM; Polymorphic test -set; Command 
Software F-Prot v2.21; Dr Solomon's AVTK for NetWare v7.55; EliaShim 



ViruSafe v2.15; |tt£S TBAV for Networks v6 . 52 ; H+BE|j^AntiVir for 
NetWare v0.97c ; 10 Ant i -Virus for NetWare v2 . 4 ; In^^ LANDesk Virus 
Protect v3.0; KAMI AVP for NetWare vl.OO; McAfee NetShield v2.3; 
Norman Virus Control for NetWare v3.5; Norton Anti-Virus for NetWare 
v2 . 0 . 2 ; Sophos Sweep v2 . 8 1 
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TI PC pesticides [Windows 95 anti-virus software] . 

AU Hewlett, D. 

Published by: 'Efigj5^^@Sq ^^^ fty 
CODEN: WPCMFQ ISSN: 0956-5248 
SICI : 0956-5248 (1996 04) 81L. 124 : PWAV/l-T 
DT Journal 

TC Practical; Product Review 
CY United Kingdom 
LA English 

AB Find out how to protect your PC against the 7 00 0 known computer 

viruses with the latest Windows 95 ready software. 
CC D5000 Office automation - computing; D1060 Security 
CT COMPUTER VIRUSES; SOFTWARE REVIEWS 

ST Windows 95 anti -virus software; PC pesticides; computer viruses; bug 
program; Trojan horse; Cyberspace; Word for Windows; macro 
viruses; Green Stripe; Boza; software packages; Sweep; Sophos; 
Norton Anti -Virus 95; configuration option; Dr Solomon's; McAfee 
Virus Scan; SMEG virus; VirusScan 
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TI REFLEX: New Macro Interceptor offers protection against 

macro viruses without reducing performance 
SO M2 Presswire, (26 Nov 1997) . 
PB M2 Communications 
DT Newsletter 
LA English 
WC 560 

TX M2 PRESSWIRE-26 November 1997-REFLEX: New Macro Interceptor from 
Reflex offers effective protection against macro 
viruses without reducing performance to a crawl (C) 1994-97 
M2 COMMUNICATIONS LTD 

RDATE: 261197 

Each month, Microsoft Word for Windows users are threatened by more 
and more new macro viruses . Virus 

scanner vendors are being forced to update their products 

ever more frequently just to keep up. But keeping conventional 

virus scanners up to date brings its own problems. 

The need to add literally hundreds of new virus 

"signatures" to on-access scanners month after month makes 

them increasingly unwieldy, and when their heuristics capability is 

switched on, their hunger for system resources renders them highly 

impractical. If they are set up to "scan everything" (as 

they should be if they are to be effective) , they can slow Pentium 

PC performance down to a level that would have most 486SX users 

tearing their hair out . 

Reflex Disknet Macro Interceptor from London-based data security 
specialist Reflex Magnetics is an innovative new product designed to 
counteract the threat of macro viruses without 

reducing PC performance to a crawl . Looking only for signs of 
macro virus activity, Macro Interceptor 

puts very little load on the system at all. Its radically new 
heuristic macro scanning techniques enable it to build its 
own signature library as and when it detects new strains. Thus Macro 
Interceptor users require fewer updates than those who rely on less 
focused scanning technologies. 

Macro Interceptor is designed primarily to add another layer of 
protection to the Reflex Disknet Data Security suite. However, it is 
also suitable for use as a standalone solution in applications where 
macro viruses present the greatest perceived 

threat. It is easy to use and set up, running transparently in the 
background and continually monitoring document files for signs of 
any macro virus activity. A reassuring green 

"tick" flashes on the user's screen every time a macro is moved or 
opened. An ant i- tamper function stops users removing its protection. 
(Although user resistance is highly unlikely given the negligible 
load Macro Interceptor places on the host PC.) 



Easy to use and'^Br up, Disknet Macro Interceptor fl^^the ability to 
remove macro viruses automatically as 

soon as they are found -- without any intervention from the user at 
all. Alternatively, it can be set up to alert users to any virus 
activity with a pop-up dialogue box that lists all infected files. 
Documents can also be checked manually by either dragging and 
dropping . them onto the Macro Interceptor icon or by using the 
program's "Scan Fil.e" option. 

Reflex Disknet Macro Interceptor requires an 80486 or Pentium PC 
running Windows 95, with a minimum 2MB of free hard disk space and 
16MB system RAM. The package is available now, and retails at GBP 
19.00 + VAT per user for up to ten users, with progressive discounts 
bringing the price down to as little as GBP 5.00 + VAT per user for 
large volume orders. Technical support and on-line maintenance 
updates are supplied free of- charge for the first year, and are 
charged annually at 20% of the purchase price thereafter. 

CONTACT: Phillip Benge, Reflex Magnetics Limited Tel: +44 (0)171 372 
6666 Fax: +44 (0)171 372 2507 e-mail: phillip .benge@ref lex- 
magnetics . co . uk WWW: http://www.reflex-magnetics.co.uk 

*M2 COMMUNICATIONS DISCLAIMS ALL LIABILITY FOR INFORMATION PROVIDED 
WITHIN M2 PRESSWIRE. DATA SUPPLIED BY NAMED PARTY/ PARTIES . * 

COPYRIGHT 1997 M2 Communications 

Subscription: $ unavailable. Published 260 times per year. Contact 
M2 Communications, PO Box 5 05, Coventry, England CV2 5YA. Phone 
44-1203-634700 . 
CE . Computers and Electronics 
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TX IBM Antivirus Version 2.5 Features New "Check on Access" 
for Superior Virus Protection 

IBM has introduced a new version of its IBM Antivirus 
software that has been enhanced to provide safer, faster 
virus protection for the Internet, including the ability to 
scan Internet documents for viruses before they 
infect the computer. 

As more and more people access the Internet, online services and 
other global networks, viruses can spread faster than ever before. 
IBM Antivirus Version 2.5 provides protection from more than 8,000 
strains of computer viruses, including the Concept virus 
and other Word macro viruses . 

Macro viruses, which infect . macro 

programs embedded in documents, have emerged as a new and 
rising problem. The Concept virus, for instance, which infects 
Microsoft Word documents, was first seen less than a year ago, and 
is now one of the most prevalent viruses in the world. 

IBM Antivirus Version 2.5 contains industry- leading new technology 
to prevent, detect, verify and disinfect Word 
macro viruses. And it has been designed to protect 
users from any future Word macro viruses, with 
free data file updates from IBM. 

Ideal for businesses of all sizes, as well as home users, IBM 
Antivirus Version 2.5 supports the most popular Intel-based computer 
platforms, including Windows NT. The software was recently 
certified to meet virus detection standards 

developed by the National Computer Security Association. Currently, 
the Department of Defense is installing IBM Antivirus at every Army, 
Navy and Air Force base nationwide. 

The new version provides superior Internet protection, with its new 
"check on access" technology, which scans a file for 
viruses whenever it is accessed, including when files are 
uploaded or downloaded from the Internet, or via E-mail, online 
services, bulletin board systems or other sources. 

In addition to "check on access", IBM Antivirus scans 

memory, hard and floppy drives, and network servers for thousands of 
viruses, including polymorphic viruses that change to 
avoid detection. It has dramatically improved its 
detection rate for boot viruses. For Windows 3.x 
users, IBM Antivirus now offers automated, scheduled 
scanning and uses a new VxD (virtual device driver) , for 
active protection, providing more complete protection than 
traditional TSRs can . 



Developed at IB] 
Antivirus incori 




tigh Integrity Computing Labora 
es world-class IBM anti-virus • 




oology, such 



, IBM 



as neural networks that detect previously unknown 
viruses. At the laboratory, part of IBM's Thomas J . Watson 
Research Center, a team of anti-virus experts and professional 
developers have applied their expertise to the science and 
technology behind IBM Antivirus for over a decade. 

One of their key projects, an immune system for cyberspace, will be 
able to automatically detect and disinfect both known and unknown 
viruses in minutes via the Internet, working much like the human 
immune system. It was recently recognized by Discover Magazine as an 
outstanding technological innovation in computer software. 
In upcoming releases, IBM Antivirus will integrate more and more of 
this immune system technology, ultimately providing global, 
Internet-based protection from viruses. 

IBM has a worldwide support team of anti-virus experts and a 
Computer Emergency Response Team (CERT) to respond quickly to virus 
incidents. In addition, the IBM Antivirus Web site provides accurate 
and timely information about computer viruses. For 
example, updates to detect any newly discovered Word 
macro viruses will be available on this site. For 

ongoing virus protection, IBM offers one- and two-year subscription 
plans, as well as free monthly virus detection 

and disinfection updates downloadable from CompuServe or the IBM 
Antivirus home page on the Worldwide Web. 

IBM Antivirus, is part of IBM's SecureWay family. IBM of f ers . I/T 
Security consulting services, and hardware and software 
products with a strong focus on the Internet. These capabilities are 
described on IBM's I/T Security home page: 

http : //www/ibm. com/Security . For more information on the IBM 
Antivirus solution, visit the product home page at 
http://www.brs.ibm.com/ibmav.html or call 1-800-742-2493. 
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TI Software Said To Guard Against Word Macro 
Viruses 08/16/96 

TX OTTAWA , ONTARIO, CANADA, 1996 AUG 16 (NB) By Grant Buckler. Look 

Software Systems Inc., has released a software 
add-on for Microsoft Word that scans for macro 
viruses. Virus Alert for Macro will 

catch viruses that ordinary ant i -virus packages do not, a 
company official said. 

In recent months, viruses constructed using Word's 
macro language have been a growing concern. At least one 
macro virus written for Microsoft's Excel 
spreadsheet software has also been reported, but Word 
seems to be the main target . 

Stephen Goodchild, vice-president of sales and marketing at Look 
Software, said standard anti- virus packages, which run as 
stand-alone utilities, may catch macro viruses 

if they are on the system at the time it is started up and the virus 
software knows the "footprint" of the virus (a pattern of 
code unique to the virus, which anti- virus programs often 
use to spot known viruses) . 

However, Goodchild said, standard anti-virus 

software will not usually spot macro 

viruses they don't. know about tobegin with, while 

Virus Alert for Macro will identify macros 

that perform suspicious actions. Also, he said, Virus 

Alert for Macro scans each document that Word 

opens, so an infected document downloaded from the Internet and 
immediately opened cannot get past it. 

What Virus Alert for Macro will not do is spot 

viruses that are not Microsoft Word macros. You 

will still need a standard virus protection program for 

that, said Goodchild. Look Software will be glad to sell 

you one; the company's flagship product is Virus Alert Plus. 

Virus Alert for Macro is due to begin shipping 

on September 2, and the list price is US$29.95. Look will sell the 

software by phone order at 800-678-5511. Goodchild said the 

company has some retail outlets and is negotiating with distributors 

he could not name. Evaluation copies of the software are 

available at Look's site on the World Wide Web, http://www.look.com 

(19960816/Press Contact: Stephen Goodchild, 613-822-2250, fax 
613-822-2160, Internet e-mail sgoodchi@look.achilles.net; Public 
Contact: Look Software, 800-678-5511) 
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LI 5 S (VIRUS?) (5A) MACRO# 

L2 13 S VIRUS? (10A) MACRO# 

L3 8 S L2 NOT LI 

L4 550 S (DEBUG? OR ANALY? OR DETECT? OR MONITOR? OR TEST?) (5A) 
MAC 

L5 1 S L4 AND (DETECT? OR RECOGNIZ? OR MONITOR? OR FILTER?) (5A 
) V 

L6 212 S 395/183 .14/CCLS 

L7 498 S 395/183 .14, 701, 704, 708/CCLS 

L8 10 S L7 AND L4 

L9 127 S L4 AND 395/CLAS 

L10 0 S L9 AND VIRUS? 

Lll 3 S L4 AND 395/183 . 14/CCLS 

= > 
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LI 


116 


S 


MACROVIRUS? OR MACRO? (2A) 


L2 


0 


S 


VIRUSTRACK 


L3 


0 


S 


LI AND 395/CLAS 


L4 


2477 


S 


ON? /ASN 


L5 


73 


S 


L4 .AND ON TECHNOLO?/ASN 


L6 


0 


S 


L3 AND VIRUS? 


L7 


0 


S 


L5 AND MACRO? 


L8 


80 


S 


LOOK? /ASN 


L9 


0 


S 


L8 AND VIRUS? 


L10 


0 


S 


LOOK TECHNO LOG? /ASN 


Lll 


0 


S 


LOOK SOFTWARE? /ASN 


L12 


0 


S 


MACRO VIRUS? 



= > 



1 f 
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Search Options: 

Search for both singular and plurals: YES 

Search for spelling variants : YES 

Display intermediate result sets : NO 



Num 


Search 


XL -1 
#1 


macro virus? 


XL ^ 

#2 


macro? w/ 5 virus? 


XL O 

#3 


macro? and virus? 


#4 


virus? and (computer? or software or program? or 




templete or macro?) 


#5 


macro 


#6 


macro and (scan? or detect? or test? or check? or 




filter?) 


#7 


#6 and software 


#8 


#5 and debug? 


#9 


TI (VIRUS) 


#10 


TI (MACRO) and virus? 


#11 


TI (MACRO) and ti(ydrus?) 


#12 


TI (MACRO) 


#13 


TI (MACRO) and secur? 


#14 


ti (whats in a word?) 
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Search Options: 

Search for both singular and plurals: YES 
Search for spelling variants : YES 

Display intermediate result sets : NO 



Num 


Search 




Hits 


#1 


macro virus? 




0 


#2 


macro? w/5 virus? 




0 


#3 


macro? and virus? 




0 


#4 


virus? and (computer? or software or 
templete or macro?) 


program? or 


55 


#5 


macro 




480 


#6 


macro and (scan? or detect? or te'st? 
filter?) ~ 


or check? or 


136 


#7 


#6 and software 




13 


#8 


#5 and debug? 
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